What this chapter is really for
The PDF is two decks stapled together. Slide 1–21 is Chapter 1-a: Introduction to Web Development and slide 22–58 is Chapter 1-b: How the Web Works. They are graded very differently, so study them differently.
Part A (slides 1–21) — context
History, circuit vs packet switching, web vs desktop apps, static vs dynamic, Web 2.0, client-server, internet infrastructure. Almost entirely narrative. Skim it once, memorize five dates and one comparison table, move on.
Part B (slides 22–58) — the machinery
The four-layer model, IP, TCP vs UDP, DNS, URL anatomy, HTTP methods, headers, status codes. This is where the marks are, and it is also the foundation you will silently rely on in every later chapter — GET vs POST in ch. 2 forms, ports in ch. 6 Node, status codes in ch. 7 REST APIs.
The single most useful thing you can take out of this chapter is a mental picture of what happens between typing a URL and seeing a page. Everything else in the chapter hangs off that one story.
All 59 slides, weighted
| Slides | Topic | Weight | What to do with it |
|---|---|---|---|
| 1–4 | Title, syllabus, prerequisites | Skim | Slide 3 lists the technical prerequisites: zip/unzip, cd navigation, conditionals, loops, try/catch, objects. If any of those are shaky, fix them now — ch. 4 assumes all of them. |
| 5–8 | Internet vs WWW, circuit vs packet switching, birth of the web | Memorize | Know that the Internet is the network and the WWW is one service on it. Memorize the five things Berners-Lee defined (slide 8): URL, HTTP, web server software, HTML, browser. |
| 9–11 | Web apps vs desktop apps; KSA personal data protection law | Memorize | Classic "list three advantages / three disadvantages" question. Build the two-column table once and reread it. |
| 12–14 | Static → dynamic → Web 2.0 | Memorize | The key line on slide 14: Web 2.0 moved programming logic from the server into the browser, which is why you have to learn JavaScript. |
| 15–17 | Why programs are needed; the client-server model | Memorize | The examinable sentence is on slide 17: the essential characteristic of a server is that it listens for requests and responds. |
| 18–21 | Physical internet, undersea cables, Tier 1 backbone | Skim | Read once. Only "Tier 1 networks = the backbone" is likely to be asked. |
| 22–24 | Part B title, objectives, what a protocol is | Skim | A protocol is a set of rules partners use when they communicate. One line, learn it verbatim. |
| 25 | The four-layer TCP/IP model | Memorize | Highest-value single slide in Part A/B. Know all four layers, in order, and one job each. |
| 26–29 | Link layer, internet layer, IPv4/IPv6, PAT | Memorize | IPv4 = four 8-bit integers, dotted. IPv6 = eight 16-bit integers, hex. IPv4 exhausted in 2011; PAT is the workaround. |
| 30–32 | Transport layer: TCP guarantees, UDP trade-off | Memorize | TCP = sequence numbers + ACK + retransmit = ordered and guaranteed. UDP = no guarantee, used for streaming, VoIP, games and DNS. |
| 33 | Application layer protocols | Memorize | HTTP, SSH, FTP, POP/IMAP/SMTP, DNS. Know one sentence each. |
| 34–39 | DNS, name levels, gTLD vs ccTLD | Memorize | The three gTLD subtypes (unrestricted / sponsored / new) are a favourite. So is the fact that .arpa is the third TLD category, used for reverse lookups. |
| 40–42 | Registrars, ICANN, KSA registration | Memorize | ICANN oversees TLDs and accredits registrars. In KSA, .sa started 1995 and the Arabic TLD in 2010; government domains go through the DGA. |
| 43–44 | Address resolution, all ten steps | Memorize | Cache → primary DNS → root → TLD server → authoritative server → IP. Draw the arrows from memory; that is the exam answer. |
| 45–48 | URL anatomy: protocol, domain, port, path, query string | Write it | You must be able to label a URL part-by-part and say which parts are optional. Port 80 is the HTTP default; query strings are ?key=value&key=value. |
| 49–51 | HTTP, headers, request methods | Memorize | Request headers describe the client (Host, User-Agent, Cache-Control). Response headers describe the server and payload (Server, Last-Modified, Content-Type, Encoding). |
| 52–53 | GET vs POST | Memorize | This reappears in ch. 2 (forms), ch. 5 (submit handling) and ch. 7 (CRUD). Learn it properly once here. |
| 54–55 | Response codes and the code table | Memorize | Know the four families by first digit, plus 200, 301, 304, 401, 404, 414, 500 individually. |
| 56–58 | How browsers render; web servers and stacks | Memorize | A web server is "nothing more than a process that responds to HTTP requests". The five stack layers on slide 57 preview the whole course. |
Context: how the web got here, and why it matters to you
Internet ≠ WWW
The Internet is the global network of connected machines and the protocols that run on it. The World Wide Web is one service delivered over that network, the one that speaks HTTP and exchanges HTML. Email, SSH and file transfer are also on the Internet and are not the Web. The slides open with this distinction because the rest of Part B is about the Internet, not the Web.
Circuit switching vs packet switching
| Circuit switched | Packet switched | |
|---|---|---|
| Model | A continuous physical circuit is held open for the whole conversation, as with an operator plugging a wire into a switchboard. | The message is split into packets that are routed independently and reassembled at the far end. |
| Bandwidth | Inefficient — the line is reserved even when nobody is speaking. | Efficient — the line carries other traffic between your packets. |
| Scaling | Difficult to scale. | Scales to the modern Internet. |
| Era | Early telephony. | 1960s ARPANET → 1974 X.25 → 1979 USENET → 1981 TCP/IP → adopted across ARPANET on 1 Jan 1983. |
The five things Berners-Lee defined (1992)
Slide 8 is a list that maps almost perfectly onto the rest of this course, which makes it easy to remember and easy to examine:
- URL — uniquely identifies a resource (chapter 1)
- HTTP — describes how requests and responses operate (chapter 1)
- Web server software — responds to HTTP requests (chapter 6)
- HTML — publishes documents (chapter 2)
- A browser — makes requests and displays what it receives (chapters 3–5)
Web apps vs desktop apps
| Advantages | Disadvantages |
|---|---|
| Accessible from any Internet-enabled computer | Requires an active Internet connection |
| Work across operating systems and browsers | Sensitive data travels over the Internet |
| Updates roll out by changing the server only | Storage, licensing and use of uploaded data raise concerns |
| Centralised storage means fewer local-storage security concerns | Appearance differs across browsers |
| — | Restrictions on installing software or accessing hardware (Flash on iOS) |
| — | Plugins can interfere with JavaScript, cookies and advertisements |
Static → dynamic → Web 2.0
Static site
The server sends a file that was already written. Every visitor gets identical bytes.
Dynamic server-side site
A program on the server generates the page per request, usually from a database. This is what you build in chapters 6 and 7.
Web 2.0
Users both contribute and consume content. For a developer, the important half is that logic moved from the server into the browser — which is the reason chapters 4 and 5 exist.
Client-server
Clients vary wildly in OS, speed, screen size, memory and storage. Servers are built for traffic and bandwidth. The defining property of a server is that it listens for requests and responds.
The machinery: layers, addresses, and name resolution
The four-layer model
TCP/IP was originally abstracted as four layers. Later models subdivide it into five or seven, but this course uses the four-layer version, and questions are phrased in its terms.
| Layer | Job | Key terms |
|---|---|---|
| 4. Application | Process-to-process communication — the protocols developers actually touch. | HTTP, SSH, FTP, POP/IMAP/SMTP, DNS |
| 3. Transport | Ensures transmissions arrive in order and without error. | TCP (sequence numbers, ACK, retransmit), UDP (no guarantee) |
| 2. Internet | Routes packets between partners across networks. Best-effort only — no reply expected, no guarantee of arrival. | IP, IPv4, IPv6, PAT |
| 1. Link | Physical transmission across the medium and logical links: packet creation, transmission, reception, error detection, collisions, line sharing. | MAC address |
IP addresses
IPv4
Four 8-bit integers separated by dots, e.g. 129.89.23.1.
The address space was effectively depleted in 2011.
IPv6
Eight 16-bit integers, each written in hexadecimal for readability. Over a billion billion times as many addresses as IPv4.
PAT (Port Address Translation) lets multiple unrelated networks share one public IP address, which is how the coffee shop, your home and the university all keep working despite IPv4 exhaustion. It is a stopgap; IPv6 is the long-term answer.
TCP vs UDP — the trade-off
| TCP | UDP | |
|---|---|---|
| Guarantee | Messages arrive, and arrive in order. | No guarantee at all. |
| How | Each packet has a sequence number; each arrival is acknowledged (ACK); missing packets are retransmitted. | Fire and forget. |
| Cost | Overhead of tracking and retransmitting. | Fast and cheap. |
| Used for | The web (HTTP), file transfer, email. | Live streaming, VoIP, online games, DNS. |
The slide’s example is worth keeping: a broadcaster streaming a match to millions cannot afford to track and retransmit every lost packet, and a small amount of loss is acceptable because viewers still see the game.
DNS: why it exists
Humans do not remember numeric addresses. In the ARPANET era a single downloadable hosts
file mapped names to IPs; that stopped scaling, so it was replaced by the distributed Domain Name
System. A second, less obvious benefit: because the name is separate from the address,
a site can move to a different host without changing its name.
Name levels and TLD categories
| Category | Meaning | Examples |
|---|---|---|
| gTLD — unrestricted | Anyone may register. | .com .net .org .info |
| gTLD — sponsored | Restricted to a sponsoring community. | .gov .mil .edu |
| gTLD — new | Opened by ICANN from June 2012; over 1000 created. | .art .cash .cool .jobs .tax |
| ccTLD | Controlled by the country it represents, so each is administered differently. UK businesses register under co.uk; .ca is open to anyone living or doing business in Canada. | .sa .uk .ca |
| .arpa | Reserved for reverse DNS lookups. | — |
IDN (Internationalized Domain Names) allow non-ASCII characters and have been
deployed since 2009 — over 9 million exist. Registration in KSA: .sa from 1995, the
Arabic-script TLD from 2010; since February 2021 accredited registrars serve individuals and
non-government entities, while government entities register through the Digital Government Authority.
ICANN oversees top-level domains, accredits registrars and coordinates DNS.
Address resolution — the ten steps
Draw this from memory. It is the most likely long-answer question in the chapter.
- Client requests a domain.
- The client computer checks its local DNS cache.
- If it is not cached, the computer asks its primary DNS server.
- If that server has no cached record, it asks a root name server.
- The root server returns the address of the relevant TLD server.
- The DNS server requests the record from that TLD server.
- The TLD server returns the addresses of the domain’s authoritative DNS servers.
- The DNS server asks one of those authoritative servers for the IP.
- The authoritative server returns the IP address.
- The client finally makes its actual request to that IP.
Domain registration, in order
- Registrant searches for a domain via a registrar or reseller portal.
- The registrar queries the TLD registry operator for availability.
- If available, the registrant pays and supplies WHOIS information.
- The registrar pushes the WHOIS data to the TLD registry operator.
- The registry operator adds it to its authoritative list.
- The registry operator pushes DNS information out to the TLD name servers.
URL anatomy and HTTP — the part you keep using all semester
Label every part of a URL
https://www.funwebdev.com:8080/pages/search?term=css&page=2#results └─┬─┘ └────────┬───────┘ └─┬─┘ └─────┬────┘ └───────┬───────┘ └───┬──┘ │ │ │ │ │ │ │ │ │ │ │ └─ fragment (browser only, never sent to the server) │ │ │ │ └─ query string: key=value pairs, ? starts it, & joins them │ │ │ └─ path: maps to a location under the server root │ │ └─ port: OPTIONAL. Defaults to 80 for http, 443 for https │ └─ domain (or IP address) to connect to ← REQUIRED └─ protocol used to connect ← REQUIRED
Two details the slides call out explicitly. Port: not commonly used on production
sites, but useful to route requests to a test server, to stress test, or to get around filters;
http://funwebdev.com:8080/ connects on port 8080. Path: the server root
corresponds to a real folder on the server — often /var/www/html/ on Linux or
/inetpub/wwwroot/ on Windows — and when you request a folder rather than a file, the
server decides which file to send you.
The request/response cycle
── REQUEST ───────────────────────────────────────────── GET /pages/search?term=css HTTP/1.1 Host: www.funwebdev.com ← which site, on a shared IP User-Agent: Mozilla/5.0 ... ← data about the client machine Cache-Control: max-age=0 ── RESPONSE ──────────────────────────────────────────── HTTP/1.1 200 OK ← status code Server: nginx/1.24.0 ← data about the server Content-Type: text/html; charset=utf-8 Last-Modified: Tue, 18 Feb 2026 09:14:02 GMT Content-Encoding: gzip <!DOCTYPE html> ← optional message body <html> ... </html>
HTTP establishes a TCP connection on port 80 by default, the server waits for the request, then responds with headers, a response code, and an optional message which may include files. Headers are described by the slides as one of the most powerful aspects of HTTP: request headers carry data about the client machine, response headers carry data about the server and the data being sent.
GET vs POST
| GET | POST | |
|---|---|---|
| Purpose | Ask for the resource at a URL. | Transmit data to the server, normally from an HTML form. |
| When it happens | Clicking a link, typing a URL, using a bookmark. | Submitting a form declared with method="post". |
| Where data goes | In the query string, visible in the URL. | In the request body, not shown in the URL. |
| Consequences | Bookmarkable, cacheable, appears in history and server logs; length-limited (see 414). | Not bookmarkable, not length-limited in the same way, re-submits on refresh. |
The other methods the slides name but do not cover are HEAD, CONNECT,
TRACE and OPTIONS. You meet PUT and DELETE properly
in chapter 7.
Status codes
The first digit gives the family: 2xx success, 3xx redirection, 4xx client error, 5xx server error.
| Code | Name | What it actually means |
|---|---|---|
200 | OK | The request was successful. |
301 | Moved Permanently | The requested resource has permanently moved. |
304 | Not Modified | With appropriate Cache-Control headers, the server says its copy is no newer than the one in the client cache. |
401 | Unauthorized | The resource is protected and requires credentials. |
404 | Not Found | The requested resource was not found. The one code end users recognise. |
414 | Request URI Too Long | Too much data is being submitted through the URL — i.e. a GET that should have been a POST. |
500 | Internal Server Error | The server hit an error and tells the client almost nothing about it. |
How a page actually loads
The browser requests the initial HTML page, parses it to find every referenced resource —
images, style sheets, scripts — and requests those too. The page is only fully loaded
once all the files have been retrieved. The whole set of algorithms to download, parse, lay
out, fetch assets and produce the final interactive page is collectively called
rendering. Remember this: it is the reason chapter 4 tells you where to put your
<script> tag, and the reason chapter 5 uses DOMContentLoaded.
The application stack
Slide 57 defines a web server as "nothing more than a process that responds to HTTP requests", and lists the five parts of an application stack. This is a preview of your whole semester:
| Stack layer | Where you meet it in SE371 |
|---|---|
| Operating system | Assumed — not assessed |
| Web server software | Chapter 6 — Node’s http module and Express |
| Database | Chapter 7 — MongoDB/Mongoose and MySQL/Sequelize |
| Backend language and runtime | Chapter 6 — JavaScript on Node.js |
| Front-end languages/frameworks/libraries | Chapters 2–5 — HTML, CSS, JavaScript, the DOM |
How to make an all-theory chapter stick
You cannot code your way through chapter 1, but you can observe everything in it in about fifteen minutes. Reading the slides again is the worst use of your time; doing this instead is the best.
1. Watch a real request/response pair
Open any site → DevTools (F12) → Network tab → reload.
Click the first document row. You are now looking at exactly what slides 49–55 describe: the
request method, the request headers, the status code, and the response headers. Find
Host, User-Agent, Server, Content-Type and
Last-Modified with your own eyes once and you will not forget which side each belongs to.
2. Count the requests
Still in the Network tab, look at the request count at the bottom. That number is slide 56 — the browser fetched the HTML, parsed it, and then fetched every stylesheet, script and image it referenced. Sort by Type to see the categories.
3. Trigger the status codes yourself
curl -I https://example.com # 200 OK, plus every response header curl -I https://example.com/no-such-page # 404 Not Found curl -I http://github.com # 301 Moved Permanently → https curl -I https://httpbin.org/status/500 # 500 Internal Server Error curl -I https://httpbin.org/status/401 # 401 Unauthorized
4. Do a DNS lookup by hand
nslookup psu.edu.sa # name → IP, exactly what step 9 returns dig +trace psu.edu.sa # the whole chain: root → TLD → authoritative ping psu.edu.sa # shows the resolved IP before the first reply
The +trace output is the ten-step diagram, printed live. Run it once and the diagram
stops being something you memorised and becomes something you watched.
5. Prove GET puts data in the URL
Search for something on any site and read the address bar. The ?, the
key=value pairs and the & separators from slide 48 are right there.
Change a value in the URL and press Enter — the page responds to your edit. That is why
slide 65 of chapter 2 will tell you client-side validation is not security.
The five things people get wrong
They are not, and slide 5 opens with the distinction specifically so it can be tested. The Internet is the network of networks; the Web is one application-layer service running on it, alongside email, FTP and SSH.
Fix: The Web needs the Internet. The Internet does not need the Web.
DNS is an application layer protocol, listed on slide 33 next to HTTP and FTP. Separately, it is one of the services that runs over UDP, not TCP (slide 32). Both facts get mixed up.
Fix: DNS lives at the application layer and is carried by UDP. Two different questions, two different answers.
The Internet layer is the best-effort one — it sends a message, expects no reply, and guarantees nothing. The transport layer is the one that adds guarantees, via TCP. People swap these.
Fix: Internet layer = route it and hope. Transport layer = make sure it got there.
404 means the resource was not found — a client-side mistake about what was asked for. A crashed server is 500. A missing login is 401. A too-long query string is 414. A cached copy still being valid is 304.
Fix: Read the first digit first: 4xx is your fault, 5xx is the server’s fault.
POST only moves the data from the URL into the request body. Over plain HTTP it is still readable on the wire, and anyone can open DevTools and read or change it before sending.
Fix: POST is about where the data goes and how much of it fits, not about security. HTTPS is what makes it private.
Chapter 1 on a single screen
Four layers (top → bottom)
- Application — HTTP, SSH, FTP, SMTP/POP/IMAP, DNS
- Transport — TCP (ordered, ACKed), UDP (no guarantee)
- Internet — IP routing, best effort
- Link — physical media, MAC addresses
Status codes
2xxsuccess ·3xxredirect4xxclient error ·5xxserver error200OK ·301Moved Permanently304Not Modified ·401Unauthorized404Not Found ·414URI Too Long500Internal Server Error
URL parts
protocol— requireddomainor IP — required:port— optional, HTTP defaults to 80/path— optional, maps to a server folder?k=v&k=v— query string
DNS chain
- local cache → primary DNS
- → root name server
- → TLD server
- → authoritative server
- → IP returned, real request sent
TLD categories
- gTLD unrestricted:
.com .net .org .info - gTLD sponsored:
.gov .mil .edu - gTLD new: since June 2012, 1000+
- ccTLD: per-country rules, e.g.
.sa .arpa: reverse DNS lookups
Dates worth knowing
- 1960s ARPANET · 1974 X.25
- 1979 USENET · 1981 TCP/IP introduced
- 1 Jan 1983 TCP/IP across ARPANET
- 1992 Berners-Lee publishes the web
- 2011 IPv4 space depleted
Close the slides and answer these out loud
- Name the four layers bottom to top, and give one job for each.
- A packet arrives out of order. Which layer fixes it, and by what mechanism?
- Give three services that use UDP and say why guaranteed delivery is not worth its cost for them.
- Write out a URL that uses all six parts, then label each one and say which two are required.
- List the ten steps of address resolution without looking. Check yourself with
dig +trace. - Name the three subtypes of gTLD and give two examples of each.
- Give four HTTP status codes from four different families and say what each one tells the client.
- Explain why submitting a long form with GET can produce a 414, and what to do instead.
- List four request headers and four response headers, and say which side sends each.
- Describe what the browser does between receiving the HTML and finishing the page load.
- Name the five layers of an application stack and say which SE371 chapter covers each.
- State the difference between the Internet and the WWW in one sentence.